Do you self-host any websites or internet-facing services? What steps have you taken to secure them?
Currently I just having a basic https nginx server hosting a static website. Dunno what else I should be doing
i avoid self hosting anything important for exactly this reason... vps sure is convenient
firewall (eg iptables, pf) to permit incoming connections only on explicitly declared ports
disable root logins and permit pubkey authentication only in sshd
that's pretty much it
install and run cpanel with default password
Switch to Windows Server
delete system32
hit my modem with a hammer till the outer plastic shell cracks and then pour beer into it
Is setting the nginx config to only listen on 443 and 80 (redirects to https) different than what you're describing?
>>3mt7qgqeh7s2y
no you need something external like iptables / pf (personal recommendation is ufw if debian). this sits over your nginx. otherwise your ports will all be open on the internet.
also if you are connecting over ssh make sure to open that port as well so you dont lock yourself out (;ﾟДﾟ)
>>3mt7qgqeh7s2y
yes; especially if you are running more stuff you are going to end up with several to dozens of services that need to bind to known ports, but not necessarily be bound to your world-facing interface. eg if you set up something like a feddy instance, or movienight, or whatever, they are designed to have a reverse proxy (like nginx) sitting in front of their local http ports which nginx itself connects to, and people in the outside world should -not- be able to connect to.
you can set up these services to bind only to your local interface and use netstat to see all open ports on your system, but this gets hairy and touchy because you are configuring a bunch of different software separately. more importantly, the firewall prevents accidents or misbehaving software from exposing things that shouldn't be exposed. netstat -an | grep LISTEN may yield some surprises
Sign in to reply.